There's a lot of trouble over that very issue these days. It's caused partially, I think, by the fact that CD writing software kind of occupies a strange zone of influence over the system. It behaves kind of like a kernel mode driver and kind of like a user mode application. That's an uneasy mix, and probably explains a lot of the bad behavior people have seen from these apps under W2K. (I have never seen ANY kind of software other than CD writing software manage to lock up a W2K machine. Only drivers are supposed to be able to do that. And you're supposed to be able to get around that problem by using only WDM-adherrent drivers on your system.)
The way I have dealt with this using the Adaptec/ROXIO Easy CD Creator 4.0x and DirectCD 3.0x software is to create the user account as an admin user and to apply special restrictions to it to prevent that user from going where I don't want that user to go. As an added security buffer, I create a regular user account, then use the Run As feature of W2K so that the user accesses the CD writing function (just that one function) as that limited admin user. This is easier to do as a domain admin, I think, than it is to do as local admin on a standalone. Moving from the other direction by creating an account that is member of a lower level group and trying to increase its access/permissions just doesn't work. Right now, most (all?) of the CD writing software I've seen essentially requires admin permissions to work. You can't get there from User (or even from Power User). That's not really the way NT / W2K permissions work. (At least that's how it appears to me. I'm a relatively recent convert to the Microsoft camp, so I could certainly be mistaken.)
Mostly, I think we have to hope that the purveyors of this sort of software get their you-know-what together and release updates that get us past this rather thorny problem.
Hope you find a solution. And, if it's a neat one, that you post it for the rest of us!
Regards,
Jim